Classification - Internal #

Document Control
Authorization
TEMPLATE NAME Firewall Change Request Form
TEMPLATE VERSION 1
EFFECTIVE DATE 15-Sep-23
TEMPLATE OWNER Information Technology
TEMPLATE APPROVER Process Owner
DOCUMENT OWNER Eshwar Manchala
DOCUMENT CLASSIFICATION Restricted
DOCUMENT VERSION NO. 1

Review
TEMPLATE VERSION DATE AUTHOR
1.0 15-Sep-23 TMAC

Frequency of Review – Annually

Ownership

Bank's Information Technology is the owner of the document. Unless otherwise specified, no part of this docume
reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microf
permission in writing from Information Technology (IT). Similarly, distribution of this document to a third party is a
prohibited unless specific approval is taken from IT. This document is allowed to be distributed to vendor by IT T

Placement
The most updated copies of the document can be found on the Bank's information portal under Information Tech
section. All printed copies of this document are to be treated as uncontrolled and may be obsolete. You shall alw
consult the current authorized versions before making important decisions.

# Classification - Internal
 Classification - Internal #

DESCRIPTION
Released common template for all
Firewall Rules including MACD -

specified, no part of this document may be

ncluding photocopying and microfilm, without
this document to a third party is also
o be distributed to vendor by IT Team.

ion portal under Information Technology (IT)

nd may be obsolete. You shall always

# Classification - Internal
 Classification - Internal #

Guidelines for Firewall Change

Firewall Rule open requests for the following cases, ISG approval required to be received and attached in t
1. Manager).
Risky ports e.g. tcp-80, tcp-21, tcp-23, tcp-1521, tcp-3306, tcp-1433
Management access on services like ssh, rdp or others - directly from VDI or ser Laptop/desktop instead o
Request for RFC 1918 Supernets e.g. 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 and VDI entire super
Request for "any" source or destination or service
Request for source or destination = Internet, 3rd Party, Vendor/partner
Request for communication between PROD and UAT or PROD and DEV or UAT and DEV.
2. For tcp-22, please specify service - is it ssh or sftp?
3. All the details mentioned in the CCF for firewall rule request needs to be collected/synced from/with CMD
4. Each Justification for each rule is mandatory.
It is responsibility of Change Initiator and Change Approver (Line Manager), to take approval from Source
5. Manager if in case of Risk / Impact category is Critical or High.
6. Once Change is approved by CAB, there will not be any change in CCF template. If any change is required t
Note: This Change is applicable for Cloud Connect Zone and Cloud Landing Zone Firewall incl. of Cloud Nati
7.

# Classification - Internal
 Classification - Internal #

wall Change Control Form

o be received and attached in the Change by Change Initiator and to be verified by Change Approver(Line

or ser Laptop/desktop instead of CyberArk.

8.0.0/16 and VDI entire super nets

UAT and DEV.

ected/synced from/with CMDB.

to take approval from Source and Destination Application owner and Incident Manager / Problem

ate. If any change is required than new change needs to be raised.

one Firewall incl. of Cloud Native Firewall e.g. Security Group, VPC Firewall , Network Security Group

# Classification - Internal
 Classification - Internal #

Sr. No. Details Required

1 Source Application owner Name (as per ITGRC /CMDB) & employee code (if Multiple, add additional rec
2 Change Initiator Name & employee code
3 Line Manager Name (Change Approver) & employee code
4 Functional Head Name & employee code
Destination Application owner Name (as per ITGRC /CMDB) & employee code (if Multiple, add additiona
5
records).
6 What is the Destination Application Availability Rating (as per ITGRC)
Confirm if RULES are requested for ALL STANDBY & DR INSTANCES too.
7
(Yes/No)
8 Approval from Source Application Owner is attached in Change? (To be verified by CAB)
9 Approval from Destination Application Owner is attached in Change? (To be verified by CAB)
10 Confirm, Rules are requested for which environment?
11 In case of DEV/UAT/POC, please mention the duration. (Rules will be opened for the said duration)

Firewall Rule Template

Source Location per CMDB) Source Type
Sr.No (Select from drop-down (Hostname/Resource (Select from drop-down
11 list)
DR-BCP-NM Name/Resource list)
ServiceNow Mid ServeProd
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

# Classification - Internal
 Classification - Internal #

d Change Initiator Input

oyee code (if Multiple, add additional records). Axiom

E0902 : Eshwar Manchala
N9703 : Nilesh Kamble
P0219 : Prashant Shenoy
employee code (if Multiple, add additional
P0219 : Prashant Shenoy
GRC) 4
ANCES too.
Yes
? (To be verified by CAB) Yes
nge? (To be verified by CAB) Yes
Prod
will be opened for the said duration) NA

Source IP/ Subnet with CIDR Destination Location

Source NAT IP
(In case of Single IP mentioned (Select from drop-down
(if applicable else NA)
with
BCP/32)
PROD Mid server NA list)
DC

# Classification - Internal
 Classification - Internal #

Input

(As per CMDB) Destination Type

with CIDR or FQDN
(Hostname/Resource (Select from drop-down
(In case of Single IP
Name/Resource
Axiom list)
Prod 10.225.73.1,

# Classification - Internal
 Classification - Internal #

Tag) (As configured during

Destination NAT IP number/Port Range>) (Ad
Resource deployment) - Only
(if applicable else NA) multiple line item if more
NA TCP Port_22 >> ssh Applicable
NA to GCP CLoud

# Classification - Internal
 Classification - Internal #

AWS Security Group ID - Only

Applicable to Azure Bidirectional/
Applicable to AWS CLoud
CLoud Unidirectional
NA NA Unidirectional

# Classification - Internal
 Classification - Internal #

for Risky Justification for

<Exp date>
Access if Bidirectional Purpose of rule
(Mention Rule Expiry Date in
Permanent falling
NA under Communication if there
NA To Fulfill pre-requisite asked by CM

# Classification - Internal
 Classification - Internal #

e-requisite asked by CMDB. For Service Now Discovery

# Classification - Internal